Apparatus and method for ensuring fail-safe function of autonomous traveling system

ABSTRACT

An apparatus for ensuring a fail-safe function of an autonomous traveling system may include: a dead reckoning (DR) information input unit configured to receive plural pieces of sensing information outputted from a plurality of sensors mounted in a vehicle as DR information; an identification value calculation unit configured to calculate an identification value for determining whether the respective pieces of sensing information inputted through the DR information input unit are fails; a fail determination unit configured to determine whether the plural pieces of sensing information inputted through the DR information input unit are fails, using the identification value calculated through the identification value calculation unit; and a determination result output unit configured to combine fail determination results for the plural pieces of sensing information, obtained through the fail determination unit, and output the combined result as a final determination result.

CROSS-REFERENCES TO RELATED APPLICATION

The application claims priority from and the benefit of Korean PatentApplication No. 10-2018-0108982, filed on Sep. 12, 2018, which is herebyincorporated by reference for all purposes as if fully set forth herein.

BACKGROUND Field

Exemplary embodiments of the invention relate to an apparatus and methodfor ensuring a fail-safe function of an autonomous traveling system, andmore particularly, to an apparatus and method for ensuring a fail-safefunction of an autonomous traveling system, which can preventutilization of wrong information by monitoring a fail in dead reckoninginformation and thus further ensure and improve the reliability of thefail-safe function, in the autonomous traveling system which has thefail-safe function using the DR information to estimate robust positiondetermination information capable of ensuring the reliability ofposition determination information.

Discussion of the Background

In general, an autonomous traveling system refers to a system thatestimates the current position of a traveling vehicle based on positiondetermination information and road map information which are constructedthrough the GPS and various sensors (for example, a radar, a LiDAR, acamera and the like), and controls autonomous traveling of the vehicleusing the estimated current position information of the vehicle.

Examples of the position determination technology for estimating thecurrent position of a vehicle in the autonomous traveling system mayinclude satellite navigation, map matching and the like. In the positiondetermination technology, the reliability of estimated positiondetermination information is significantly changed depending onsurrounding environments of the vehicle. The reduction in reliability ofthe position determination information may degrade the entireperformance of the autonomous traveling system.

As such, the conventional position determination technology estimatesrelatively accurate position determination information, but does notensure the reliability of the position determination information.Therefore, wrong position determination information is likely to beutilized in the autonomous traveling system.

Therefore, a fail-safe function for estimating robust positiondetermination information is necessarily required to ensure thereliability of position determination information. Furthermore, thereliability of the fail-safe function needs to be ensured.

The related art of the present invention is disclosed in Korean PatentApplication Laid-Open No. 10-2017-0107767 published on Sep. 26, 2017 andentitled “Vehicle Terminal Control System and Method”.

The above information disclosed in this Background section is only forenhancement of understanding of the background of the invention and,therefore, it may contain information that does not constitute priorart.

SUMMARY

Exemplary embodiments of the present invention provide an apparatus andmethod for ensuring a fail-safe function of an autonomous travelingsystem, which can prevent utilization of wrong information by monitoringa fail in dead reckoning information and thus further ensure and improvethe reliability of the fail-safe function, in the autonomous travelingsystem which has the fail-safe function using the DR information toestimate robust position determination information capable of ensuringthe reliability of position determination information.

In one embodiment, an apparatus for ensuring a fail-safe function of anautonomous traveling system may include: a dead reckoning (DR)information input unit configured to receive plural pieces of sensinginformation outputted from a plurality of sensors mounted in a vehicleas DR information; an identification value calculation unit configuredto calculate an identification value for determining whether therespective pieces of sensing information inputted through the DRinformation input unit are fails; a fail determination unit configuredto determine whether the plural pieces of sensing information inputtedthrough the DR information input unit are fails, using theidentification value calculated through the identification valuecalculation unit; and a determination result output unit configured tocombine fail determination results for the plural pieces of sensinginformation, obtained through the fail determination unit, and outputthe combined result as a final determination result.

The DR information input unit may receive one or more pieces of steeringangle sensor (SAS) information, wheel speed sensor information, yaw ratesensor (YRS) information and gear information.

The identification value calculation unit may output a normalidentification value and an error identification value as anidentification value for determining a fail.

The identification value calculation unit may calculate theidentification value for determining whether the sensing information isa fail, using a rule-based method and a model-based method.

According to the rule-based method, the identification value calculationunit may output a normal identification value when a plurality of presetconditions are all satisfied for each of the pieces of sensinginformation inputted through the DR information input unit, and outputan error identification value when any one of the plurality of presetconditions is not satisfied.

The plurality of conditions may include one or more of: whether thesensing information is a normal diagnosis signal containing no noise;whether time required until the sensing information is collected isdelayed by a designed specific time or more; whether the sensinginformation is out of a range between a preset maximum value and apreset minimum value; and whether the sensing information is a valuethat has been increased by more than a preset increment.

According to the model-based method, the identification valuecalculation unit may estimate a measurement value of a YRS designated asa specific sensor through Equation 1 below, compare an estimation valueobtained by estimating the measurement value of the YRS to an actualmeasurement value collected by the YRS, output a difference valuecorresponding to a difference therebetween, and output a normalidentification value or an error identification value as a finalidentification value depending on whether the difference value exceeds adesignated threshold:

$\begin{matrix}{\psi_{est} = {\frac{\sin ( {\theta_{SA}/G_{SAS}} )}{l_{wheel}} \times V_{wheel} \times D_{gear}}} & \lbrack {{Equation}\mspace{14mu} 1} \rbrack\end{matrix}$

where θ_(SA) represents a steering wheel angle, G_(SAS) represents agear ratio, l_(wheel) represents a wheel length, V_(wheel) represents awheel speed, ψ_(est) represents a yaw rate estimation value, ψ_(raw)represents a yaw rate measurement value, D_(gear) represents adirection, and T_(test) represents a difference value (test statistics).

The determination result output unit may output the fail determinationresult as: normal when the fail determination unit determines that allof the plural pieces of sensing information inputted through the DRinformation input unit are normal; a warning when results determinedthrough a model-based method are close to a threshold within adesignated range while results determined through a rule-based methodare normal; and a fail when a fail occurs in one or more pieces ofsensing information.

The identification value calculation unit, the fail determination unitand the determination result output unit may be integrated to functionas a control unit.

In another embodiment, a method for ensuring a fail-safe function of anautonomous traveling system may include: receiving, by a control unit,plural pieces of sensing information outputted from a plurality ofsensors mounted in a vehicle as DR information; calculating, by thecontrol unit, an identification value for determining whether therespective pieces of sensing information received as the DR informationare fails; determining, by the control unit, whether the plural piecesof sensing information received as the DR information are fail, usingthe calculated identification value; and combining, by the control unit,the fail determination results for the plural pieces of sensinginformation, and outputting the combined result as a final determinationresult.

The DR information may include one or more of SAS information, wheelspeed sensor information, YRS information and gear information.

The control unit may output a normal identification value and an erroridentification value as an identification value for determining a fail.

The control unit may calculate the identification value for determiningwhether the sensing information is a fail, using a rule-based method anda model-based method.

According to the rule-based method, the control unit may output a normalidentification value when a plurality of preset conditions are allsatisfied for each of the pieces of sensing information inputted as theDR information, and output an error identification value when any one ofthe plurality of preset conditions is not satisfied.

The plurality of conditions may include one or more of: whether thesensing information is a normal diagnosis signal containing no noise;whether time required until the sensing information is collected isdelayed by a designed specific time or more; whether the sensinginformation is out of a range between a preset maximum value and apreset minimum value; and whether the sensing information is a valuethat has been increased by more than a preset increment.

According to the model-based method, the control unit may estimate ameasurement value of a YRS designated as a specific sensor throughEquation 1 below, compares an estimation value obtained by estimatingthe measurement value of the YRS to an actual measurement valuecollected by the YRS, outputs a difference value corresponding to adifference therebetween, and outputs a normal identification value or anerror identification value as a final identification value depending onwhether the difference value exceeds a designated threshold:

$\begin{matrix}{\psi_{est} = {\frac{\sin ( {\theta_{SA}/G_{SAS}} )}{l_{wheel}} \times V_{wheel} \times D_{gear}}} & \lbrack {{Equation}\mspace{14mu} 1} \rbrack\end{matrix}$

where θ_(SA) represents a steering wheel angle, G_(SAS) represents agear ratio, l_(wheel) represents a wheel length, V_(wheel) represents awheel speed, ψ_(est) represents a yaw rate estimation value, ψ_(raw)represents a yaw rate measurement value, D_(gear) represents adirection, and T_(test) represents a difference value (test statistics).

The control unit outputs the fail determination result as: normal whenall of the plural pieces of sensing information inputted as the DRinformation are determined to be normal; a warning when resultsdetermined through a model-based method are close to a threshold withina designated range while results determined through a rule-based methodare normal; and a fail when a fail occurs in one or more pieces ofsensing information.

In accordance with the embodiments of the present invention, theapparatus and method for ensuring a fail-safe function of an autonomoustraveling system can prevent utilization of wrong information bymonitoring a fail in DR information and thus further ensure and improvethe reliability of the fail-safe function, in the autonomous travelingsystem which has the fail-safe function using the DR information toestimate robust position determination information capable of ensuringthe reliability of position determination information.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and areintended to provide further explanation of the invention as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are included to provide a furtherunderstanding of the invention and are incorporated in and constitute apart of this specification, illustrate embodiments of the invention, andtogether with the description serve to explain the principles of theinvention.

FIG. 1 is a block diagram illustrating an autonomous traveling system inaccordance with an embodiment of the present invention.

FIGS. 2A and 2B are diagrams illustrating an initial diagnosis processperformed by an initial diagnosis unit based on a distribution chart ofposition determination results.

FIGS. 3A and 3B are diagrams illustrating a process in which asingle-sensor fail-safe diagnosis unit of FIG. 1 performs a fail-safediagnosis for a single sensor.

FIGS. 4A and 4B are diagrams illustrating a process in which acomposite-sensor fail-safe diagnosis unit of FIG. 1 performs a fail-safediagnosis for a composite sensor.

FIG. 5 is a flowchart illustrating a fail-safe diagnosis method forposition determination results in the autonomous traveling system inaccordance with the embodiment of the present invention.

FIG. 6 is a diagram illustrating a schematic configuration of anapparatus for ensuring a fail-safe function of an autonomous travelingsystem in accordance with an embodiment of the present invention.

FIG. 7 is a diagram for describing a rule-based method through which anidentification value calculation unit calculates an identification valuein FIG. 6.

FIG. 8 is a diagram for describing a model-based method through whichthe identification value calculation unit calculates an identificationvalue in FIG. 6.

FIG. 9 is a flowchart illustrating a method for ensuring a fail-safefunction of an autonomous traveling system in accordance with anembodiment of the present invention.

DETAILED DESCRIPTION

The invention is described more fully hereinafter with reference to theaccompanying drawings, in which embodiments of the invention are shown.This invention may, however, be embodied in many different forms andshould not be construed as limited to the embodiments set forth herein.Rather, these embodiments are provided so that this disclosure isthorough, and will fully convey the scope of the invention to thoseskilled in the art. In the drawings, the size and relative sizes oflayers and regions may be exaggerated for clarity. Like referencenumerals in the drawings denote like elements.

FIG. 1 is a block diagram illustrating an autonomous traveling system inaccordance with an embodiment of the present invention.

Referring to FIG. 1, the autonomous traveling system in accordance withthe embodiment of the present invention may include a sensor-fusionposition determination module 110, a fail-safe diagnosis module 130 andan output unit 150.

The sensor-fusion position determination module 110 may include aposition determination sensor unit 112 and a position calculation unit114. The position determination sensor unit 112 may serve to measure thecurrent position of an autonomous traveling vehicle (hereafter, referredto as ‘vehicle’), and include the same types of position determinationsensors or different types of position determination sensors. Examplesof the position determination sensors may include a GPS sensor, a radarsensor, a LiDAR sensor, a camera sensor and the like. The types of theposition determination sensors are not limited, as long as they canmeasure the current position of the vehicle.

The position calculation unit 114 may fuse position values measured bythe plurality of sensors, and match the fusion result with a road mapwhich has been constructed in advance, thereby calculating a positiondetermination result. The position determination result may includeposition information of the vehicle on the road map, traveling routeinformation on the road map, and lane information based on the travelingroute information.

The fail-safe diagnosis module 130 may perform a fail-safe diagnosis forthe position determination result inputted from the sensor-fusionposition determination module 110. When diagnosing a fail or abnormalityfor the position determination result, the fail-safe diagnosis module130 may output a warning message corresponding to the fail orabnormality. When diagnosing a safe for the position determinationresult, the fail-safe diagnosis module 130 may correct the positiondetermination result. The fail-safe diagnosis module 130 will bedescribed in detail below.

The output unit 150 may process the warning message into visualinformation, tactile information or a combination thereof, and outputthe processed information. The output unit 150 may process a mapmatching result into visual information, tactile information or acombination thereof and output the processed information, the mapmatching result being obtained by matching a normal positiondetermination result passed according to the fail-safe diagnosis resultof the fail-safe diagnosis module 130 or a position determination resultrecovered through a safe processing operation with the road map. Theoutput unit 150 may include a video output module and an audio outputmodule or a combination thereof.

Although not illustrated, the video output module may include an imageprocessing unit for converting the warning message or the correctedposition determination result into image data such as text data andgraphic data, which can be outputted on an image screen, and a displayunit such as an LCD for displaying the image data, and the audio outputmodule may include an audio processing unit for converting the warningmessage or the corrected position determination result into audio datasuch as voice data and a speaker unit for outputting the audio data.

Hereafter, referring to FIGS. 2 to 4, the above-described fail-safediagnosis module 130 will be described in detail.

The fail-safe diagnosis module 130 may include an initial diagnosis unit132, a fail-safe diagnosis unit 134 and a diagnosis result output unit136, in order to perform a fail-safe diagnosis for the positiondetermination result inputted from the sensor-fusion positiondetermination module 110.

Initial Diagnosis Unit 132

The initial diagnosis unit 132 may perform an initial diagnosis forposition determination results inputted from the sensors of thesensor-fusion position determination module 110, that is, an initialfail-safe diagnosis by analyzing the frequency and distribution chart ofthe position determination results.

The frequency may be defined as the number of times (measurement count)that the position determination results are inputted from the positiondetermination sensor for a preset time. The preset time may be set tovarious values depending on design, for example, 500 ms. That is, theinitial diagnosis unit 132 may count the number of times that theposition determination results are inputted for the preset time, comparethe counted value to a preset count value (for example, five times), anddiagnose whether a fail occurred in the position determination result,based on the comparison result. For example, the initial diagnosis unit132 may determine that the initial diagnosis for the positiondetermination results is a success, when the counted value is equal toor more than five, and determine that the initial diagnosis for theposition determination results is a fail, when the counted value is lessthan five.

When the initial diagnosis for the frequency of the positiondetermination results is completed, the initial diagnosis unit 132 mayperform the initial diagnosis for the position determination resultsinputted from the sensor-fusion position determination module 110 basedon the distribution chart of the position determination results.

Hereafter, referring to FIG. 2A, the process of performing the initialdiagnosis based on the distribution chart of the position determinationresults will be described.

First, the initial diagnosis unit 132 may collect past positiondetermination results P_(k-t1), P_(k-t2) and P_(k-t3), and estimatecurrent position determination results by predicting the collected pastposition determination results P_(k-t1), P_(k-t2) and P_(k-t3) at thecurrent point of time. Hereafter, the estimated current positiondetermination results P′_(k-t1), P′_(k-t2) and P′_(k-t3) will bereferred to as ‘estimated position determination results’. As a methodfor obtaining the estimated position determination results from the pastposition determination results, dead reckoning (DR) may be used.

When the estimated position determination results P′_(k-t1), P′_(k-t2)and P′_(k-t3) are obtained, the initial diagnosis unit 132 may calculatethe standard deviation of distribution (distribution chart ordistribution region) 22 or 24 indicating how far positions indicated bythe estimated position determination results P′_(k-t1), P′_(k-t2) andP′_(k-t3) and the current position determination result P_(k) actuallyinputted from the sensor-fusion position determination module are awayfrom one another.

When the standard deviation is calculated, the initial diagnosis unit132 may compare the calculated standard deviation to a specificthreshold. The initial diagnosis unit 132 may determine that the initialdiagnosis is a success, when the standard deviation is equal to or lessthan the specific threshold, and determine that the initial diagnosis isa fail, when the standard deviation exceeds the specific threshold. FIG.2A illustrates the case in which the initial diagnosis is determined tobe a fail, and FIG. 2B illustrates the case in which the initialdiagnosis is determined to be a success. That is, the narrower thedistribution of the estimated position determination results P′_(k-t1),P′_(k-t2) and P′_(k-t3) and the current position determination resultP_(k), the higher the initial diagnosis is likely to be determined to bea success. When the initial diagnoses for the frequency and distributionchart of the position determination results are all determined to besuccesses, the initial diagnosis unit 132 may request the fail-safediagnosis unit 134 to start a fail-safe diagnosis. If at least one ofthe initial diagnoses for the frequency and distribution chart of theposition determination results fails, the fail-safe diagnosis performedby the fail-safe diagnosis module 130 may not be performed. The initialdiagnosis process by the initial diagnosis unit 132 may be performedonly once at first.

Referring back to FIG. 1, the fail-safe diagnosis unit 134 may perform afail-safe diagnosis in response to a start request message (or startrequest command) for the fail-safe diagnosis from the initial diagnosisunit 132.

In order to perform the fail-safe diagnosis, the fail-safe diagnosisunit 134 may include a single-sensor fail-safe diagnosis unit 134A and acomposite-sensor fail-safe diagnosis unit 134B.

Single-Sensor Fail-Safe Diagnosis Unit 134A

The single-sensor fail-safe diagnosis unit 134A may perform a fail-safediagnosis for each of the single sensors. FIGS. 3A and 3B illustrate aprocess in which the single-sensor fail-safe diagnosis unit of FIG. 1performs a fail-safe diagnosis for the single sensor. FIG. 3Aillustrates the case in which the fail-safe diagnosis for the singlesensor is determined to be a success, and FIG. 3B illustrates the casein which the fail-safe diagnosis for the single sensor is determined tobe a fail.

In order to perform a fail-safe diagnosis for each of the singlesensors, an identifier may be given to each of the single sensors.

The single-sensor fail-safe diagnosis unit 134A may collect pastposition determination results P_(k-t1), P_(k-t2) and P_(k-t3) measuredby a target single sensor through the above-described DR method,estimate position determination results P′_(k-t1), P′_(k-t2) andP′_(k-t3) at the current point of time (hereafter, referred to asestimated position determination results) from the collected pastposition determination results P_(k-t1), P_(k-t2) and P_(k-t3), comparethe estimated position determination results P′_(k-t1), P′_(k-t2) andP′_(k-t3) to a current position determination result P_(k) which isactually measured at the current point of time, and diagnose whether afail occurs. At this time, a threshold for diagnosing whether a failoccurs may be set. The threshold may indicate an allowable error range30 (hereafter, referred to as a fail allowable error range or a firstfail allowable error range) defined in the specification of the targetsingle sensor, based on the current position determination result P_(k).

According to the method for diagnosing whether a fail occurs in thetarget single sensor, the single-sensor fail-safe diagnosis unit 134Amay determine that the fail-safe diagnosis is a success, when the entiredistribution region (position distribution chart, distribution chart orfirst distribution chart) {circumflex over (P)}_(k) of the estimatedposition determination results P′_(k-t1), P′_(k-t2) and P′_(k-t3) ispresent in the fail allowable error range 30 as illustrated in FIG. 3A.When the fail-safe diagnosis is determined to be a success, the currentposition determination result P_(k) may be decided as a normal positiondetermination result.

On the other hand, when the entire distribution region of the estimatedposition determination results P′_(k-t1), P′_(k-t2) and P′_(k-t3) ispresent outside the fail allowable error range 30 as illustrated in FIG.3B, the single-sensor fail-safe diagnosis unit 134A may determine thatthe fail-safe diagnosis is a fail. When the fail-safe diagnosis isdetermined to be a fail, a safe processing operation may be performed.The safe processing operation may indicate an operation of recovering aposition determination result determined to be a fail. For example, thesingle-sensor fail-safe diagnosis unit 134A may discard the currentposition determination result P_(k), select any one of the estimatedposition determination results P′_(k-t1), P′_(k-t2) and P′_(k-t3), anddecide the selected position determination result as a positiondetermination result obtained by recovering the discarded currentposition determination result P_(k). Alternatively, the single-sensorfail-safe diagnosis unit 134A may create a figure connecting thepositions indicated by the respective estimated position determinationresults P′_(k-t1), P′_(k-t2) and P′_(k-t3), and decide the centerposition of the created figure as a position determination resultobtained by recovering the discarded current position determinationresult P_(k).

The reason to select any one of the estimated position determinationresults P′_(k-t1), P′_(k-t2) and P′_(k-t3) as the position determinationresult obtained by recovering the discarded current positiondetermination result P_(k) is because the estimated positiondetermination results P′_(k-t1), P′_(k-t2) and P′_(k-t3) passed theinitial diagnosis process performed at first.

Since at least the estimated position determination results P′_(k-t1),P′_(k-t2) and P′_(k-t3) may be considered as normal positiondetermination results, the safe processing operation of decidingrecovery data using the estimated position determination results can beperformed.

When a part of the distribution region (distribution chart) {circumflexover (P)}_(k) of the estimated position determination results P′_(k-t1),P′_(k-t2) and P′_(k-t3) is present in the fail allowable error range 30,the single-sensor fail-safe diagnosis unit 134A cannot determine thatthe fail-safe diagnosis is a perfect fail. Therefore, even in this case,the single-sensor fail-safe diagnosis unit 134A can determine that thecurrent position determination result P_(k) is as a normal positiondetermination result, and may not perform the above-described safeprocessing operation for recovering a position determination result.However, the single-sensor fail-safe diagnosis unit 134A may diagnosethis case as a warning condition in which an occurrence of abnormalityis suspected.

When the fail-safe diagnosis is completed by the single-sensor fail-safediagnosis unit 134A, the single-sensor fail-safe diagnosis unit 134A maytransfer the position determination result of each of the singlesensors, determined to be a success, or the position determinationresult recovered by the safe processing operation to thecomposite-sensor fail-safe diagnosis unit 134B, and simultaneouslyrequest the composite-sensor fail-safe diagnosis unit 134B to start afail-safe diagnosis for the composite sensor.

Composite-Sensor Fail-Safe Diagnosis Unit 134B

The composite-sensor fail-safe diagnosis unit 134B may perform afail-safe diagnosis for a composite sensor including different types ofsingle sensors, in response to the request of the single-sensorfail-safe diagnosis unit 134A. FIGS. 4A and 4B illustrate a process inwhich the composite-sensor fail-safe diagnosis unit of FIG. 1 performs afail-safe diagnosis for the composite sensor. FIG. 4A illustrates thecase in which the composite-sensor fail-safe diagnosis unit determinesthat fail-safe diagnoses for all single sensors included in thecomposite sensor are successes, and FIG. 4B illustrates the case inwhich the composite-sensor fail-safe diagnosis unit determines that afail-safe diagnosis for only a certain single sensor among all of thesingle sensors included in the composite sensor is a success, andfail-safe diagnoses for the other single sensors are fails.

The fail-safe diagnosis process for the composite sensor may be similarto the above-described initial diagnosis process based on thedistribution chart.

Under the supposition that the composite sensor includes first to thirdsensors #1 to #3, the respective sensors #1 to #3 may collect pastposition determination results P_(k-t1), P_(k-t2) and P_(k-t3) whichhave been the most recently measured based on the current point of time,and estimate current position determination results P′_(k-t1), P′_(k-t2)and P′_(k-t3) by predicting the collected past position determinationresults P_(k-t1), P_(k-t2) and P_(k-t3) at the current point of timeaccording to the DR method.

Then, the composite-sensor fail-safe diagnosis unit 134B may calculatethe standard deviation of distribution chart {circumflex over (P)}_(k)(distribution region, position distribution or second distributionchart) of the estimated position determination results P′_(k-t1),P′_(k-t2) and P′_(k-t3), and compare the standard deviation to athreshold indicating a fail allowable error range 40 (second failallowable error range). When the standard deviation is equal to or lessthan the threshold (FIG. 4A), that is, when all of the estimatedposition determination results P′_(k-t1), P′_(k-t2) and P′_(k-t3) arepresent in the fail allowable error range 40, the composite-sensorfail-safe diagnosis unit 134B may determine that all of the estimatedposition determination results P′_(k-t1), P′_(k-t2) and P′_(k-t3) aresuccesses. When the standard deviation exceeds the threshold, thecomposite-sensor fail-safe diagnosis unit 134B may determine that all ofthe estimated position determination results P′_(k-t1), P′_(k-t2) andP′_(k-t3) are fails.

On the other hand, when the estimated position determination resultP′_(k-t1) obtained by predicting a position determination result,obtained by a certain sensor (hereafter, the first sensor #1) of thesensors #1 to #3 included in the composite sensor, at the current pointof time is present in the fail allowable error range 40 as illustratedin FIG. 4B, the composite-sensor fail-safe diagnosis unit 134B may notdetermine that all of the estimated position determination resultsP′_(k-t1), P′_(k-t2) and P′_(k-t3) are fails, but perform the safeprocessing operation to decide the estimated position determinationresult P′_(k-t1) as estimated position determination results obtained byrecovering the other estimated position determination results P′_(k-t2)and P′_(k-t3) determined to be fails. At this time, when a plurality ofestimated position determination results are present in the failallowable error range 40, the composite-sensor fail-safe diagnosis unit134B may perform the safe processing operation to decide, as therecovered position determination result, the position determinationresult estimated through the sensor having the highest reliability amongthe respective sensors which have generated the plurality of estimatedposition determination results present in the fail allowable error range40. The sensor having the highest reliability may be defined as thesensor having the smallest allowable error range among the allowableerror ranges present in the specifications of the respective sensors. Inorder to identify the sensors present in the fail allowable error range,various geometric methods may be utilized.

Diagnosis Result Output Unit 136

Referring back to FIG. 1, when all of the fail-safe diagnoses for thesingle sensors and the composite sensor by the fail-safe diagnosis unit134 are completed, the diagnosis result output unit 136 may provide auser with a message corresponding to the diagnosis result by referringto the following table in which the diagnosis result is classified intoa plurality of fail levels.

TABLE 1 Fail Level Condition Countermeasure Availability Level0 NormalOutput normal Available Level1 Abnormal Issue warning Available Level2Fail occurs in some sensors Safe processing Available Level3 Fail occursin all sensors Fail processing Not available

Table 1 defines fail levels based on fail-safe diagnosis results inaccordance with the embodiment of the present invention.

In an example, the fail levels may be classified into four stages.Level0 may indicate the case in which the position determination resultsare normal. That is, Level0 may indicate the case in which the initialdiagnosis and the fail-safe diagnoses for the single sensors and thecomposite sensor are all determined to be successes. Level1 may indicatethe case in which an abnormality occurred. That is, Level1 may indicatethe case in which the distribution region {circumflex over (P)}_(k) ofthe estimated position determination results in the fail-safe diagnosesfor the single sensors partially overlaps the fail allowable error range30. Level2 may indicate the case in which a fail which can be recoveredthrough the safe processing operation occurred during the fail-safediagnosis. Level 3 may indicate the case in which a fail which cannot berecovered through the safe processing operation occurred. When a failoccurs at Levels0, Level1 and Level2, the position determination resultsmay be available. However, when a fail occurs at Level3, the positiondetermination result may not be available, and the system may performthe initial diagnosis again.

FIG. 5 is a flowchart illustrating a fail-safe diagnosis method forposition determination results in the autonomous traveling system inaccordance with the embodiment of the present invention. When steps ofthe fail-safe diagnosis method are described, contents overlapping thecontents described with reference to FIGS. 1 to 4 will be brieflydescribed or omitted herein.

Referring to FIG. 5, the fail-safe diagnosis module 130 may perform theinitial diagnosis for position determination results inputted from eachof the single sensors included in the sensor-fusion positiondetermination module 110 by analyzing the frequency and distributionchart of the position determination results, in step S510. The initialdiagnosis may be performed once at first for each of the sensors.

As described above, the frequency may indicate the number of times(measurement count) that the position determination results are inputtedfrom the position determination sensor for the preset time. For example,the fail-safe diagnosis module 130 may determine that the initialdiagnosis for the position determination results is a success, when themeasurement count is equal to or more than five, and determine that theinitial diagnosis for the position determination results is a fail, whenthe measurement count is less than five.

When the initial diagnosis for the frequency is completed, the fail-safediagnosis module 130 may perform the initial diagnosis based on thedistribution chart of the position determination results. Specifically,the fail-safe diagnosis module 130 may calculate the standard deviationof distribution (distribution chart or distribution region) 22 or 24,indicating how far positions indicated by estimated positiondetermination results P′_(k-t2) and P′_(k-t3) obtained by predictingpast position determination results P_(k-t2) and P_(k-t3) at the currentpoint of time and a current position determination result P_(k) which isactually inputted from the sensor are away from one another, and comparethe calculated standard deviation to a specific threshold.

The fail-safe diagnosis module 130 may determine that the initialdiagnosis is a success, when the deviation is equal to or less than thespecific threshold, and determine that the initial diagnosis is a fail,when the deviation exceeds the specific threshold.

When the initial diagnoses based on the frequency and distribution chartof the position determination results are determined to be successes,the fail-safe diagnosis module 130 may perform a fail-safe diagnosis forthe single sensor by using a first distribution chart including theestimated position determination results obtained by predicting the pastposition determination results inputted from the single sensor after theinitial diagnosis at the current point of time and the current positiondetermination result inputted from the single sensor.

Specifically, the fail-safe diagnosis module 130 may perform a fail-safediagnosis on the single sensor, based on a result obtained by comparingthe standard deviation of the first distribution chart to the thresholdindicating the first fail allowable error range defined in the singlesensor based on the current position determination result. For example,the fail-safe diagnosis module 130 may determine that the fail-safediagnosis for the single sensor is a fail, when the standard deviationexceeds the threshold, and determine that the fail-safe diagnosis forthe single sensor is a success or the safe processing operation can beperformed, when the standard deviation is equal to or less than thethreshold.

When it is determined that the fail-safe diagnosis for the single sensoris a success or the safe processing operation can be performed, thefail-safe diagnosis module 130 may analyze a second distribution chartincluding estimated position determination results obtained bypredicting the most recently measured position determination resultsfrom composite sensors including the single sensor at the current pointof time, and perform a fail-safe diagnosis for the composite sensors, instep S530.

Specifically, the fail-safe diagnosis module 130 may perform a fail-safediagnosis for the composite sensors based on a result obtained bycomparing and analyzing the standard deviation of the seconddistribution chart and the threshold indicating the second fail allowerror range defined in advance. For example, the fail-safe diagnosismodule 130 may determine that the fail-safe diagnoses for all of thecomposite sensors are fails, when the standard deviation exceeds thethreshold, and determine that the fail-safe diagnoses for all of thecomposite sensors are successes, when the standard deviation is equal toor less than the threshold.

Then, when the fail-safe diagnoses for all of the composite sensors arecompleted, the fail-safe diagnosis module 130 may output the diagnosisresult in step S540.

The diagnosis result may be outputted in the form of a message which canbe classified into four stages of fail levels Level0 to Level3.

Level0 may indicate the case in which the position determination resultsare normal. That is, Level0 may indicate the case in which the initialdiagnosis and the fail-safe diagnoses for the single sensors and thecomposite sensor are all determined to be successes.

Level1 may indicate the case in which an abnormality occurred. That is,Level1 may indicate the case in which the distribution region{circumflex over (P)}_(k) of the estimated position determinationresults in the fail-safe diagnoses for the single sensors partiallyoverlaps the fail allowable error range 30. Level2 may indicate the casein which a fail which can be recovered through the safe processingoperation occurred during the fail-safe diagnosis. Level 3 may indicatethe case in which a fail which cannot be recovered through the safeprocessing operation occurred. When a fail occurs at Levels0, Level1 andLevel2, the position determination results may be available. However,when a fail occurs at Level3, the position determination result may notbe available, and the system may perform the initial diagnosis again.

It should be understood that the block diagram of FIG. 1 illustratingthe autonomous traveling system with a fail-safe function specifies theprinciple of the present invention in terms of function. Similarly, itshould be understood that the flowchart of FIG. 5 shows variousprocesses performed by a computer or processor, regardless of whetherthe flowchart can be substantially expressed through a computer readablemedium or the computer or processor is clearly illustrated.

The blocks of FIG. 1, which are illustrated as a processor or a conceptsimilar to the processor, may be provided as the use of dedicatedhardware and hardware capable of executing software.

When the blocks of FIG. 1 are implemented by a processor, the functionsof the blocks illustrated in FIG. 1 may be provided by a singlededicated processor, a single shared processor or a plurality ofindividual processors, and some of the blocks may be shared.

However, the fail-safe function described with reference to FIGS. 1 to 5is performed under the supposition that a fail in DR information servingas reference information is not sensed and the DR information is anunconditional true value. Therefore, wrong DR information is likely tobe used. As a result, the reliability of the fail-safe function may bedegraded.

For reference, the DR information may indicate sensing information usedfor the DR method. The DR method may indicate a method for estimatingthe position and route of a vehicle using information sensed through theplurality of sensors mounted in the vehicle, when the vehicle enters ashaded area such as a tunnel or basement parking lot, where a GPS signalcannot be received. However, as the application time of the DRincreases, drift errors of the sensors may be accumulated to infinity.

Therefore, the present embodiment provides an apparatus and method forensuring a fail-safe function of an autonomous traveling system, whichcan monitor a fail in DR information and prevent utilization of wronginformation in advance, thereby further ensuring and improving thereliability of the fail-safe function in an autonomous traveling systemhaving a fail-safe function using the DR information.

FIG. 6 is a diagram illustrating a schematic configuration of anapparatus for ensuring a fail-safe function of an autonomous travelingsystem in accordance with an embodiment of the present invention.

Referring to FIG. 6, the apparatus for ensuring a fail-safe function ofan autonomous traveling system in accordance with the embodiment of thepresent invention may include a DR information input unit 200, anidentification value calculation unit 310, a fail determination unit 320and a determination result output unit 330.

Hereafter, in the present embodiment, the functions of theidentification value calculation unit 310, the fail determination unit320 and the determination result output unit 330 will be described asseparate components for the convenience of description. However, itshould be noted that the functions of the identification valuecalculation unit 310, the fail determination unit 320 and thedetermination result output unit 330 may be performed together by thecontrol unit 300.

The DR information input unit 200 may receive information of a pluralityof vehicle sensors mounted in the vehicle and gear information. Theplurality of vehicle sensors may include an SAS (Steering Angle Sensor),a wheel speed sensor and a YRS (Yaw Rate Sensor).

The identification value calculation unit 310 may calculate anidentification value (or diagnosis value) for determining whether eachpiece of sensing information inputted through the DR information inputunit 200 is a fail.

The identification value calculation unit 310 may calculate anidentification value for determining whether the sensing information isa fail, using two kinds of methods (for example, a rule-based method anda model-based method).

FIG. 7 is a diagram for describing the rule-based method through whichthe identification value calculation unit calculates an identificationvalue in FIG. 6.

Referring to FIG. 7, the rule-based method may include outputting adesignated identification value (for example, 1 or 0) by determiningwhether a plurality of preset conditions (for example, a sensordiagnosis signal, a measurement signal delay, a maximum/minimum valueand an increment value) are satisfied for sensing information inputtedthrough the DR information input unit 200.

For example, when the DR information is inputted, the identificationvalue calculation unit 310 may check whether the input DR information,i.e. sensing information, is a normal diagnosis signal containing nonoise, in step S601.

When the check result indicate that the DR information is not a normaldiagnosis signal (No in step S601), the identification value calculationunit 310 may output a preset error identification value (for example, 0)in step S606.

On the other hand, when the check result indicates that the DRinformation is a normal diagnosis signal (Yes in step S601), theidentification value calculation unit 310 may calculate a time requireduntil the DR information, i.e. sensing information, is collected andcheck whether a time delay occurred by a designed specific time or more,in step S602.

When the check result indicates that a time delay occurred by thespecific time or more (No in step S602), the identification valuecalculation unit 310 may output a preset error identification value (forexample, 0) in step S606.

On the other hand, when the check result indicates that a time delay didnot occur by the designated specific time or more (Yes in step S602),the identification value calculation unit 310 may check whether the DRinformation, i.e. sensing information, is out of the range between apreset maximum value and a preset minimum value or corresponds to avalue between the maximum value and the minimum value, in step S603.

When the check result of step S603 indicates that the DR information isout of the range between the maximum value and the minimum value (No instep S603), the identification value calculation unit 310 may output thepreset error identification value (for example, 0) in step S606.

When the check result of step S603 indicates that the DR information isnot out of the range between the maximum value and the minimum value(Yes in step S603), the identification value calculation unit 310 maycheck whether the DR information, i.e. sensing information, is a valuethat has been increased by more than a preset increment or increased bythe preset increment or less, in step S604.

When the check result of step S604 indicates that the DR information isa value that has been increased by more than the preset increment (No instep S604), the identification value calculation unit 310 may output thepreset error identification value (for example, 0) in step S606.

When the check result of step S604 indicates that the DR information isnot a value that has been increased by more than the preset increment(Yes in step S604), the identification value calculation unit 310 mayoutput a preset normal identification value (for example, 1) in stepS605.

As described above, the identification value calculation unit 310 mayoutput the normal identification value (for example, 1) when theplurality of preset conditions (for example, the sensor diagnosissignal, the measurement time delay, the maximum/minimum value and theincrement value) are all satisfied for the sensing information inputtedthrough the DR information input unit 200, and output the erroridentification value (for example, 0) when any one of the plurality ofpreset conditions is not satisfied.

FIG. 8 is a diagram for describing the model-based method through whichthe identification value calculation unit calculates an identificationvalue in FIG. 6.

Referring to FIG. 8, the model-based method may include estimating(predicting) a measurement value of a specific sensor (for example, aYRS) based on a mathematical model in step S701, comparing an estimationvalue obtained by estimating the measurement value of the specificsensor to an actual measurement value collected by the specific sensorin step S702, and outputting a value corresponding to a differencetherebetween, that is, a difference value or diagnosis value in stepS703.

For reference, the measurement value of the specific sensor (forexample, a YRS) may be estimated (predicted) by Equation 1 below, andthe difference value may be calculated by Equation 2 below.

$\begin{matrix}{\psi_{est} = {\frac{\sin ( {\theta_{SA}/G_{SAS}} )}{l_{wheel}} \times V_{wheel} \times D_{gear}}} & \lbrack {{Equation}\mspace{14mu} 1} \rbrack \\{T_{test} = {{\psi_{row} - \psi_{est}}}} & \lbrack {{Equation}\mspace{14mu} 2} \rbrack\end{matrix}$

In Equations 1 and 2, θ_(SA) represents a steering wheel angle, G_(SAS)represents a gear ratio, l_(wheel) represents a wheel length, V_(wheel)represents a wheel speed, ψ_(est) represents a yaw rate estimationvalue, ψ_(raw) represents a yaw rate measurement value, D_(gear)represents a direction, and T_(test) represents a difference value (teststatistics).

As described above, a measurement value in the model-based method isdetected through the YRS, and three pieces of sensing information amongfour pieces of sensing information inputted through the DR informationinput unit 200 may be adjusted to calculate a yaw rate estimation value.Then, a difference value between the actual measurement value of the YRSand the estimation value may be outputted as the final identificationvalue.

The fail determination unit 320 may determine whether the four pieces ofsensing information inputted through the DR information input unit 200are fails, using the identification value calculated by theidentification value calculation unit 310.

For example, the fail determination unit 320 may determine whether thefour pieces of sensing information are normal, when the identificationvalue outputted from the identification value calculation unit 310 is 1,and determine whether the four pieces of sensing information are failsor errors, when the identification value is 0.

Since it is impossible to determine whether the value (difference value)calculated through the model-based method is a fail, the finalidentification value (for example, 1 or 0) may be outputted depending onwhether the difference value exceeds a designated threshold. Therefore,the fail determination unit 320 may determine that the difference valueis normal, when the final identification value outputted from theidentification value calculation unit 310 is 1, and determine that thedifference value is a fail or error, when the identification value is 0.

At this time, the threshold may be calculated through Equation 3 below.

T _(threshold) =M _(yaw)ψ_(row) +M _(speed) V_(wheel)+σ_(yrs)  [Equation 3]

In Equation 3, σ_(yrs) represents YRS noise, T_(test) represents thedifference value, T_(threshold) represent the threshold, M_(you)represents a margin of the YRS, and M_(speed) represents a margin of thewheel speed sensor.

At this time, the margins of the YRS and the wheel speed sensor aretuning parameters capable of deciding the sensitivity of faildetermination.

The determination result output unit 330 may output the faildetermination result obtained through the fail determination unit 320.

At this time, when a fail occurs in any one piece of information amongplural pieces of sensing information of the plurality of sensors (foursensors), inputted through the DR information input unit 200, the DRinformation at the corresponding point of time cannot be used becausethe DR information is utilized as reference information of a finalposition determination result.

For example, the determination result output unit 330 may output thefail determination result as normal when the fail determination unit 320determines that all of the plural pieces of sensing information of theplurality of sensors (four sensors), inputted through the DR informationinput unit 200, are normal, output the fail determination result as awarning when the results determined through the model-based method areclose to the threshold within a designated range while the resultsdetermined through the rule-based method are all normal, and output thefail determination result as a fail when a fail occurs in one or more ofthe sensors (one or more pieces of sensing information).

The result outputted by the determination result output unit 330 (forexample, normal, warning or fail) may be outputted to the sensor-fusionposition determination module 110 described with reference to FIG. 1.Thus, when the result is finally outputted as a fail, the DR informationat this point of time may not be utilized for the fail/safe function ofmap matching, which makes it possible to further ensure and improve thereliability of the fail-safe function.

FIG. 9 is a flowchart illustrating a method for ensuring a fail-safefunction of an autonomous traveling system in accordance with anembodiment of the present invention.

As illustrated in FIG. 9, the control unit 300 may receive plural piecesof DR information (for example, SAS information, wheel speed sensorinformation, YRS information and gear information) through the DRinformation input unit 200 in step S801.

The control unit 300 may calculate an identification value fordetermining whether each piece of sensing information inputted throughthe DR information input unit 200 is a fail.

At this time, the control unit 300 may calculate an identification valuefor determining whether the sensing information is a fail, using theabove-described two methods (for example, the rule-based method and themodel-based method).

Through the rule-based method, the control unit 300 may output thenormal identification value (for example, 1) when the plurality ofpreset conditions (for example, the sensor diagnosis signal, themeasurement time delay, the maximum/minimum value and the increment) areall satisfied for the sensing information inputted through the DRinformation input unit 200, and output the error identification value(for example, 0) when any one of the plurality of preset conditions isnot satisfied.

Furthermore, through the model-based method, the control unit 300 mayestimate (predict) a measurement value of a specific sensor (forexample, the YRS), compare an estimation value obtained by estimatingthe measurement value of the specific sensor to an actual measurementvalue collected by the specific sensor, and output a value correspondingto a difference therebetween, that is, a difference value.

Since it is impossible to determine whether the value (difference value)calculated through the model-based method is a fail, the finalidentification value (for example, 1 or 0) may be outputted depending onwhether the difference value exceeds the designated threshold.

The control unit 300 may determine whether the plural pieces of sensinginformation of the plurality of sensors, inputted through the DRinformation input unit 200, are fails, using the calculatedidentification value, in step S803.

For example, the fail determination unit 320 may determine that theplural pieces of sensing information are normal, when the identificationvalue outputted from the identification value calculation unit 310, i.e.the final identification value, is 1, and determine that the pluralpieces of sensing information are fails or errors, when theidentification value is 0.

The control unit 300 may output the fail determination result in stepS804.

For example, the control unit 300 may output the fail determinationresult as normal when all of the plural pieces of sensing information ofthe plurality of sensors (four sensors), inputted through the DRinformation input unit 200, are determined to be normal, output the faildetermination result as a warning when the results determined throughthe model-based method are close to the threshold while the resultsdetermined through the rule-based method are all normal, and output thefail determination result as a fail when a fail occurs in one or more ofthe sensors (one or more pieces of sensing information).

At this time, the output result (for example, normal, warning or fail)may be outputted to the sensor-fusion position determination module 110described with reference to FIG. 1. Thus, when the result is finallyoutputted as a fail, the DR information at this point of time may not beutilized for the fail/safe function of map matching, which makes itpossible to further ensure and improve the reliability of the fail-safefunction.

Although preferred embodiments of the invention have been disclosed forillustrative purposes, those skilled in the art will appreciate thatvarious modifications, additions and substitutions are possible, withoutdeparting from the scope and spirit of the invention as defined in theaccompanying claims.

What is claimed is:
 1. An apparatus for ensuring a fail-safe function ofan autonomous traveling system, comprising: a dead reckoning (DR)information input unit configured to receive pieces of sensinginformation outputted from a plurality of sensors mounted in a vehicleas DR information; an identification value calculation unit configuredto calculate an identification value for determining whether therespective pieces of sensing information inputted through the DRinformation input unit are fails; a fail determination unit configuredto determine whether the pieces of sensing information inputted throughthe DR information input unit are fails, using the identification valuecalculated through the identification value calculation unit; and adetermination result output unit configured to combine faildetermination results for the pieces of sensing information, obtainedthrough the fail determination unit, and output the combined faildetermination result as a final determination result.
 2. The apparatusof claim 1, wherein the DR information input unit is configured toreceive one or more pieces of steering angle sensor (SAS) information,wheel speed sensor information, yaw rate sensor (YRS) information andgear information.
 3. The apparatus of claim 1, wherein theidentification value calculation unit is configured to output a normalidentification value and an error identification value as anidentification value for determining a fail.
 4. The apparatus of claim1, wherein the identification value calculation unit is configured tocalculate the identification value for determining whether the pieces ofsensing information are fails, using a rule-based method and amodel-based method.
 5. The apparatus of claim 4, wherein according tothe rule-based method, the identification value calculation unit isconfigured to output a normal identification value when a plurality ofpreset conditions are all satisfied for each of the pieces of sensinginformation inputted through the DR information input unit, and tooutput an error identification value when any one of the plurality ofpreset conditions is not satisfied.
 6. The apparatus of claim 5, whereinthe plurality of conditions comprise at least one of: whether the piecesof sensing information are normal diagnosis signals containing no noise;whether time required until the pieces of sensing information iscollected is delayed by a designed specific time or more; whether thepieces of sensing information are out of a range between a presetmaximum value and a preset minimum value; and whether the pieces ofsensing information are values that have been increased by more than apreset increment.
 7. The apparatus of claim 4, wherein according to themodel-based method, the identification value calculation unit isconfigured to estimate a measurement value of a YRS designated as aspecific sensor through Equation 1 below, to compare an estimation valueobtained by estimating the measurement value of the YRS to an actualmeasurement value collected by the YRS, to output a difference valuecorresponding to a difference therebetween, and to output a normalidentification value or an error identification value as a finalidentification value depending on whether the difference value exceeds adesignated threshold: $\begin{matrix}{\psi_{est} = {\frac{\sin ( {\theta_{SA}/G_{SAS}} )}{l_{wheel}} \times V_{wheel} \times D_{gear}}} & \lbrack {{Equation}\mspace{14mu} 1} \rbrack\end{matrix}$ wherein θ_(SA) represents a steering wheel angle, G_(SAS)represents a gear ratio, l_(wheel) represents a wheel length, V_(wheel)represents a wheel speed, ψ_(est) represents a yaw rate estimationvalue, and D_(gear) represents a direction.
 8. The apparatus of claim 1,wherein the determination result output unit is configured to output thecombined fail determination result as: normal in response to the faildetermination unit determining that all of the pieces of sensinginformation inputted through the DR information input unit are normal; awarning in response to results determined through a model-based methodbeing close to a threshold within a designated range while resultsdetermined through a rule-based method are normal; and a fail inresponse to a fail occurring in one or more pieces of sensinginformation.
 9. The apparatus of claim 1, wherein the identificationvalue calculation unit, the fail determination unit and thedetermination result output unit are integrated to function as a controlunit.
 10. A method for ensuring a fail-safe function of an autonomoustraveling system, comprising: receiving, by a control unit, pieces ofsensing information outputted from a plurality of sensors mounted in avehicle as dead reckoning (DR) information; calculating, by the controlunit, an identification value for determining whether the respectivepieces of sensing information received as the DR information are fails;determining, by the control unit, whether the pieces of sensinginformation received as the DR information are fails, using thecalculated identification value; and combining, by the control unit,fail determination results for the pieces of sensing information, andoutputting the combined fail determination result as a finaldetermination result.
 11. The method of claim 10, wherein the DRinformation comprises one or more of SAS information, wheel speed sensorinformation, YRS information and gear information.
 12. The method ofclaim 10, wherein the control unit is configured to output a normalidentification value and an error identification value as anidentification value for determining a fail.
 13. The method of claim 10,wherein the control unit is configured to calculate the identificationvalue for determining whether the sensing information is a fail, using arule-based method and a model-based method.
 14. The method of claim 13,wherein according to the rule-based method, the control unit isconfigured to output a normal identification value when a plurality ofpreset conditions are all satisfied for each of the pieces of sensinginformation inputted as the DR information, and to output an erroridentification value when any one of the plurality of preset conditionsis not satisfied.
 15. The method of claim 14, wherein the plurality ofconditions comprise at least one of: whether the pieces of sensinginformation are normal diagnosis signals containing no noise; whethertime required until the pieces of sensing information are collected isdelayed by a designed specific time or more; whether the pieces ofsensing information are out of a range between a preset maximum valueand a preset minimum value; and whether the pieces of sensinginformation are values that have been increased by more than a presetincrement.
 16. The method of claim 13, wherein according to themodel-based method, the control unit is configured to estimate ameasurement value of a YRS designated as a specific sensor throughEquation 1 below, to compare an estimation value obtained by estimatingthe measurement value of the YRS to an actual measurement valuecollected by the YRS, to output a difference value corresponding to adifference therebetween, and to output a normal identification value oran error identification value as a final identification value dependingon whether the difference value exceeds a designated threshold:$\begin{matrix}{\psi_{est} = {\frac{\sin ( {\theta_{SA}/G_{SAS}} )}{l_{wheel}} \times V_{wheel} \times D_{gear}}} & \lbrack {{Equation}\mspace{14mu} 1} \rbrack\end{matrix}$ where θ_(SA) represents a steering wheel angle, G_(SAS)represents a gear ratio, l_(wheel) represents a wheel length, V_(wheel)represents a wheel speed, ψ_(est) represents a yaw rate estimationvalue, and D_(gear) represents a direction.
 17. The method of claim 10,wherein the control unit is configured to output the fail determinationresult as: normal in response to all of the pieces of sensinginformation inputted as the DR information being determined to benormal; a warning in response to results determined through amodel-based method being close to a threshold within a designated rangewhile results determined through a rule-based method are normal; and afail in response to a fail occurring in one or more pieces of sensinginformation.